Red Hat Bugzilla – Bug 149270
logrotate is messing up with noexec mounted /tmp
Last modified: 2007-11-30 17:11:00 EST
Description of problem: After an updgrade to FC3 logrotate fails to switch to new logs with only not that informative messages from cron like: error: error running shared postrotate script for /var/log/cups/*_log Debugging information is not much more revealing either and only strace eventually shows that logrotate writes to a file with permissions 0700 in /tmp and tries to run that directly instead of doing "sh /tmp/<whatever>". With /tmp which happens to be mounted "noexec" this clearly fails. Moreover logrotate.conf does not provide any options to switch temporary directory somewhere else. Luckily TMPDIR seems to work but AFAICS this is not mentioned in a documentation either. Older versions of logrotate did not suffer from this affliction so this came as a nasty surprise. Version-Release number of selected component (if applicable): logrotate-3.7.1-2
Created attachment 111293 [details] Check this. I hope it will work fine. Logrotate does not use tmpfile in /tmp to run script.
What I see in a code indeed it looks that it will work. There is one more nit, though. Both the current and the previous code (it was writing "#!/bin/sh\n\n" at the top of a temporary file) presume that all logrorate scripts would have to comprise from a valid sh code (well, bash in practical terms). I do not see that explicitely documented anywhere. A trivial "one liner" shell wrapper really allows to use there anything which will execute but one should not dig through sorces to reach that conclusion.
"Luckily TMPDIR seems to work but AFAICS this is not mentioned in a documentation either." How exactly would I use TMPDIR to get around this problem? I tried defining it in the shell script that runs logrotate, but that didn't help.
export TMPDIR=/var/tmp as the second line in /etc/cron.daily/logrotate should do assuming that a version of /usr/sbin/logrotate pays attention to that variable. Worksforme.
3.7.1-5.RHEL4, with last changelog entries from 2005-07-13, is broken in the same way as 3.7.1-2